Analysis
-
max time kernel
211s -
max time network
215s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 15:46
Static task
static1
Behavioral task
behavioral1
Sample
RvcDownloader.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
RvcDownloader.exe
Resource
win10v2004-20231215-en
General
-
Target
RvcDownloader.exe
-
Size
1.1MB
-
MD5
7f6ce9a396cae9d375cb1a56de268b84
-
SHA1
4129cc4492f057cc2ec78c195c1badd7ab3d9c65
-
SHA256
604d490b9d5dfff01c9fceb085798c6b42f5778c9f125457be654dc4f436ab04
-
SHA512
e3cfe5afbde8b7889767cd9556ddbff2a3652ab139f06f02ec27cbd638d05604b3cbd5dcc2732a62750ced77d32eeab69b92e7eca38fe434121611c8775c314d
-
SSDEEP
24576:YAKoSJz+0Iw0kyFKLjA4OInTbghKT+5YqyIkIIWV+05rk4o/iq6MH:HCS7wDNjA4OIPiDGqyIkHfy0N
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation RvcDownloader.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Executes dropped EXE 4 IoCs
pid Process 4844 Dllhost.exe 1504 Server.exe 2952 Server.exe 1652 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 38 2.tcp.eu.ngrok.io 54 2.tcp.eu.ngrok.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs
pid Process 4080 RvcDownloader.exe 4080 RvcDownloader.exe 4080 RvcDownloader.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 1504 Server.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 2952 Server.exe 2952 Server.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 1652 Server.exe 4844 Dllhost.exe 4844 Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1400 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4080 RvcDownloader.exe 4844 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe Token: 33 4844 Dllhost.exe Token: SeIncBasePriorityPrivilege 4844 Dllhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe 4844 Dllhost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4080 RvcDownloader.exe 4844 Dllhost.exe 1504 Server.exe 2952 Server.exe 1652 Server.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4080 wrote to memory of 4844 4080 RvcDownloader.exe 91 PID 4080 wrote to memory of 4844 4080 RvcDownloader.exe 91 PID 4080 wrote to memory of 4844 4080 RvcDownloader.exe 91 PID 4844 wrote to memory of 1400 4844 Dllhost.exe 95 PID 4844 wrote to memory of 1400 4844 Dllhost.exe 95 PID 4844 wrote to memory of 1400 4844 Dllhost.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\RvcDownloader.exe"C:\Users\Admin\AppData\Local\Temp\RvcDownloader.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
PID:1400
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1504
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2952
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
507B
MD525d1b50e7c0d451f3d850eb54d27ca05
SHA1a238807715c70a335f54e80d4855644b21a9e870
SHA256650faa13e983c9046c9030f63a5fa1c33900432ec7cb3762e015da2e7c5b34a5
SHA5124223a26b2fabefdf1c01443ccc7bd887464d27f02694379895a040c66db472d541218d501f1c01e1bd31012d079a31baf24e20882c32cf652a09a74e3bf385f5
-
Filesize
1.1MB
MD57f6ce9a396cae9d375cb1a56de268b84
SHA14129cc4492f057cc2ec78c195c1badd7ab3d9c65
SHA256604d490b9d5dfff01c9fceb085798c6b42f5778c9f125457be654dc4f436ab04
SHA512e3cfe5afbde8b7889767cd9556ddbff2a3652ab139f06f02ec27cbd638d05604b3cbd5dcc2732a62750ced77d32eeab69b92e7eca38fe434121611c8775c314d